Skip to main content

More Info:

GCP DNS CNAMEs Missing Storage Bucket

Risk Level

High

Address

Security

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of missing CNames for a GCP storage bucket in GCP DNS using the GCP console, follow these steps:
  1. Open the GCP Console (https://console.cloud.google.com) and log in to your GCP account.
  2. Navigate to the Cloud Storage section by clicking on the menu icon in the top-left corner and selecting “Storage” under the “Storage” category.
  3. Select the storage bucket for which you want to add CNames.
  4. In the bucket details page, click on the “Edit website configuration” button located in the top bar.
  5. Scroll down to the “Custom domain” section and click on the “Add a custom domain” button.
  6. In the “Domain name” field, enter the desired domain name or subdomain for your storage bucket. For example, if you want to use “assets.example.com,” enter “assets” in the field.
  7. Click on the “Add” button to add the custom domain.
  8. GCP will validate the domain ownership by providing you with a unique verification token. Copy the token provided.
  9. Open a new tab or window and navigate to your DNS provider’s website.
  10. Sign in to your DNS provider’s console and locate the DNS management section.
  11. Create a new CNAME record for your desired domain or subdomain. In the “Name” or “Host” field, enter the desired domain or subdomain name (e.g., “assets” or “assets.example.com”).
  12. In the “Value” or “Points to” field, enter the storage bucket URL provided by GCP. It should be in the format “c.storage.googleapis.com” followed by your bucket name (e.g., “c.storage.googleapis.com/example-bucket”).
  13. Save the CNAME record.
  14. Return to the GCP console tab and click on the “Verify” button next to the domain you added.
  15. Paste the verification token you copied earlier into the provided field and click on the “Verify” button.
  16. Once the domain ownership is verified, click on the “Save” button to apply the changes.
  17. Wait for DNS propagation to complete, which may take some time (usually a few minutes to a few hours) depending on your DNS provider.
After following these steps, the CNames for your GCP storage bucket will be added and properly configured in GCP DNS using the GCP console.

To remediate the misconfiguration of missing CNames for a storage bucket in GCP DNS using GCP CLI, follow these step-by-step instructions:
  1. Open the GCP Cloud Shell or ensure that you have the GCP CLI (Command Line Interface) installed on your local machine.
  2. Authenticate with your GCP account by running the following command:
  3. Set the appropriate GCP project where the misconfigured storage bucket resides:
  4. Verify the existing DNS records for the project by running:
    Replace <zone_name> with the name of the DNS zone where the storage bucket is located.
  5. Identify the missing CName record for the storage bucket. It should have a type of CNAME and a name corresponding to the desired subdomain.
  6. Create the CName record using the gcloud dns record-sets transaction command. Start a new transaction by running:
  7. Add the missing CName record. Replace <subdomain> with the desired subdomain and <bucket_name> with the name of the storage bucket:
  8. Commit the transaction to apply the changes:
  9. Verify that the CName record has been successfully added by running the following command:
  10. Check if the CName record is resolving correctly by using a DNS lookup tool or running the following command:
    Replace <subdomain> and <your_domain> with the appropriate values.
By following these steps, you should be able to remediate the misconfiguration of missing CNames for a storage bucket in GCP DNS using GCP CLI.
To remediate the misconfiguration of missing CNames for a GCP Storage Bucket in GCP DNS using Python, follow these step-by-step instructions:
  1. Install the necessary libraries:
    • Install the Google Cloud SDK by following the instructions provided in the official documentation: https://cloud.google.com/sdk/docs/install
    • Install the google-cloud-dns library using pip:
  2. Set up authentication:
  3. Import the required libraries and authenticate using the service account key file:
  4. Retrieve the existing DNS zone:
  5. Retrieve the existing records for the zone:
  6. Identify the missing CName record for your GCP Storage Bucket:
  7. Check if the CName record already exists in the DNS zone:
  8. If the CName record doesn’t exist, add it to the DNS zone:
  9. Once the CName record is added, verify its existence:
By following these steps, you should be able to remediate the misconfiguration of missing CNames for a GCP Storage Bucket in GCP DNS using Python.
Changing the rrdatas target may cause Terraform to replace the DNS record (destroy/create), which can briefly affect name resolution during propagation.For verification, terraform plan should show a single google_dns_record_set resource with an updated rrdatas value changing from the old, non-existent bucket hostname to YOUR_BUCKET_NAME.storage.googleapis.com..